{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "UAT-10147 is a financially motivated actor using AI to automate complex post-compromise tasks. Detecting the elevation and evasion chain stops the actor before they deploy persistent web shells or exfiltrate data." }, "name": "UAT-10147: Host Elevation and Evasion", "type": "investigation", "labels": [ "hunt", "attack.t1059.001", "attack.t1068", "attack.t1562.001", "attack.t1053.005", "attack.t1505.003", "attack.t1021.001" ], "series": { "slug": "uat-10147-integrates-agentic-ai-into-post-compromise-operations", "index": 2, "title": "UAT-10147 integrates agentic AI into post-compromise operations", "total": 3 }, "related": [ { "hunt": "uat-10147-initial-access", "reason": "Initial web-level exploitation occurs before these host-centric scripts run.", "relation": "precedes" }, { "hunt": "uat-10147-c2-and-exfiltration", "reason": "Exfiltration over the Nacos C2 channel happens after the host foothold is secured.", "relation": "follows" }, { "hunt": "web-exploit-telemetry-theft-uat-10147", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule cannot connect the drop of a batch script to a subsequent Defender exclusion and a deceptive scheduled task. This hunt uses a phased approach to pivot across file, process, registry, and job surfaces to weigh the entire chain.", "coverage": [ { "stage": "automated-foothold-execution", "steps": [ "staged-script-drops" ], "status": "covered" }, { "stage": "privilege-escalation-exploits", "steps": [ "rare-elevation-commands" ], "status": "covered" }, { "stage": "antivirus-exclusion-evasion", "steps": [ "evasion-registry-activity" ], "status": "covered" }, { "stage": "iis-server-discovery", "steps": [ "persistence-scheduled-jobs" ], "status": "covered" }, { "stage": "persistence-mechanisms", "steps": [ "persistence-scheduled-jobs" ], "status": "covered" }, { "stage": "web-application-exploitation", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" }, { "stage": "c2-implant-communication", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" }, { "stage": "system-telemetry-exfiltration", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Web Application Exploitation", "slug": "web-application-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2022-27925", "CVE-2021-23758", "CVE-2019-18935", "adminapi.tippusoni.in", "exploitation of Zimbra Collaboration Suite", "exploitation of AjaxPro", "exploitation of Telerik UI for ASP.NET AJAX" ] }, { "name": "Automated Foothold Execution", "slug": "automated-foothold-execution", "tactic": "execution", "techniques": [ "T1059", "T1059.001" ], "observables": [ "back.bat", "back.txt", "user.bat", "bai.bat", "certutil -urlcache -split -f", "Runtime.exec()", "dll.zip", "prcc1.rar" ] }, { "name": "Privilege Escalation Exploits", "slug": "privilege-escalation-exploits", "tactic": "privilege-escalation", "techniques": [ "T1059" ], "observables": [ "EfsPotato", "CVE-2022-0995", "CVE-2021-3156", "CVE-2015-5287", "CVE-2015-3246", "CVE-2010-3904", "CVE-2022-0847", "Dirty Pipe exploitation" ] }, { "name": "Antivirus Exclusion Evasion", "slug": "antivirus-exclusion-evasion", "tactic": "defense-evasion", "techniques": [ "T1059.001" ], "observables": [ "Add-MpPreference -ExclusionPath C:\\Windows\\SysWOW64\\inetsrv", "Add-MpPreference -ExclusionPath C:\\Windows\\System32\\inetsrv", "reg add \"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\"", "powershell.exe Add-MpPreference" ] }, { "name": "IIS Server Discovery", "slug": "iis-server-discovery", "tactic": "discovery", "techniques": [ "T1059" ], "observables": [ "appcmd list site /config /xml", "C:\\Windows\\system32\\inetsrv\\appcmd" ] }, { "name": "Persistence Mechanisms", "slug": "persistence-mechanisms", "tactic": "persistence", "techniques": [ "T1053.005", "T1505.003", "T1021.001" ], "observables": [ "Google Chrome Start", "BadIIS", "addition of user to Remote Desktop Users group", "rogue local user account creation", "System32\\inetsrv\\BadIIS.dll" ] }, { "name": "C2 Implant Communication", "slug": "c2-implant-communication", "tactic": "command-and-control", "techniques": [ "T1071", "T1090.003" ], "observables": [ "139.180.197.150", "svchosts.exe", "QuasarRAT", "NoodleRAT", "SPECTRE", "Gh0stCringe", "Meterpreter" ] }, { "name": "System Telemetry Exfiltration", "slug": "system-telemetry-exfiltration", "tactic": "exfiltration", "techniques": [ "T1041" ], "observables": [ "HTTP POST to Nacos configuration server", "exfiltration of id and hostname", "exfiltration of %USERNAME% and %COMPUTERNAME%" ] } ], "summary": "UAT-10147 targets Windows and Linux web servers globally, integrating agentic AI to optimize exploit development and post-compromise orchestration. The campaign leverages high-volume vulnerability exploitation followed by automated privilege escalation, defense evasion through antivirus exclusions, and persistence via rogue IIS modules and scheduled tasks." }, "severity": "high", "rationale": "Focus on internet-exposed web servers. Narrow the hunt by prioritizing servers where hb_software_inventory shows IIS, Nacos, or ASP.NET components.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is executing automated staging scripts to deploy privilege escalation tools and blind security software on compromised web servers.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional hostnames to narrow the search." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "staged_scripts": { "from": { "ref": "UAT-10147 blog", "kind": "article", "observed": "2026-01-20" }, "type": "list[path]", "default": [ "back.bat", "back.txt", "user.bat", "bai.bat" ], "description": "Reported filenames of the staging batch scripts." }, "exclusion_paths": { "from": { "ref": "UAT-10147 blog", "kind": "article", "observed": "2026-01-20" }, "type": "list[path]", "default": [ "c:\\windows\\syswow64\\inetsrv", "c:\\windows\\system32\\inetsrv" ], "description": "Directories the adversary excludes from Windows Defender." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/", "name": "Cisco Talos \u2014 UAT-10147 integrates agentic AI into post-compromise operations" } ], "blind_spots": [ { "id": "no-process-telemetry", "risk": "A compromised host without EDR coverage can execute the elevation chain without generating process logs, leaving only the registry or file aftermath.", "stage": "privilege-escalation-exploits", "question": "whether elevation tools were executed on unmanaged servers", "requires": "EDR agent coverage (hb_process_activity) on every web server" }, { "id": "obfuscated-script-content", "risk": "If the adversary renames scripts and obfuscates command strings, simple filename matching will fail to identify the foothold.", "stage": "automated-foothold-execution", "question": "what instructions were executed if batch scripts use environment variable expansion", "requires": "hb_script_activity content de-obfuscation" } ] }, "name": "UAT-10147: Host Elevation and Evasion", "description": "This hunt targets the endpoint-centric phase of UAT-10147 operations, where an adversary uses semi-autonomous playbooks to operationalize offensive tradecraft. The actor deploys multi-stage batch scripts to download privilege escalation tools like EfsPotato, modifies the Windows Registry to exclude malicious IIS directories from Defender scans, and establishes persistence through deceptive scheduled tasks. The hunt follows a phased flow: it first identifies initial foothold scripts and rare elevation commands, then pivots to look for the subsequent defense evasion and persistence mechanisms that secure the intruder's presence." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "uat-10147-integrates-agentic-ai-into-post-compromise-operations", "index": 2, "title": "UAT-10147 integrates agentic AI into post-compromise operations", "total": 3 }, "coverage": [ { "stage": "automated-foothold-execution", "steps": [ "staged-script-drops" ], "status": "covered" }, { "stage": "privilege-escalation-exploits", "steps": [ "rare-elevation-commands" ], "status": "covered" }, { "stage": "antivirus-exclusion-evasion", "steps": [ "evasion-registry-activity" ], "status": "covered" }, { "stage": "iis-server-discovery", "steps": [ "persistence-scheduled-jobs" ], "status": "covered" }, { "stage": "persistence-mechanisms", "steps": [ "persistence-scheduled-jobs" ], "status": "covered" }, { "stage": "web-application-exploitation", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" }, { "stage": "c2-implant-communication", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" }, { "stage": "system-telemetry-exfiltration", "reason": "Belongs to another part of the 'UAT-10147 integrates agentic AI into post-compromise operations' series.", "status": "out_of_scope" } ], "rationale": "An adversary is executing automated staging scripts to deploy privilege escalation tools and blind security software on compromised web servers.", "blind_spots": [ { "id": "no-process-telemetry", "risk": "A compromised host without EDR coverage can execute the elevation chain without generating process logs, leaving only the registry or file aftermath.", "stage": "privilege-escalation-exploits", "question": "whether elevation tools were executed on unmanaged servers", "requires": "EDR agent coverage (hb_process_activity) on every web server" }, { "id": "obfuscated-script-content", "risk": "If the adversary renames scripts and obfuscates command strings, simple filename matching will fail to identify the foothold.", "stage": "automated-foothold-execution", "question": "what instructions were executed if batch scripts use environment variable expansion", "requires": "hb_script_activity content de-obfuscation" } ], "scoping_notes": "Focus on internet-exposed web servers. Narrow the hunt by prioritizing servers where hb_software_inventory shows IIS, Nacos, or ASP.NET components.", "beyond_detection": "A single rule cannot connect the drop of a batch script to a subsequent Defender exclusion and a deceptive scheduled task. This hunt uses a phased approach to pivot across file, process, registry, and job surfaces to weigh the entire chain." } }, { "id": "scope-web-servers", "type": "query", "label": "Identify web server scope", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%iis%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%nacos%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_software_inventory", "description": "Focus the hunt on hosts running web server software or frameworks targeted by UAT-10147.", "expected_signal": "A list of hostnames acting as web servers. Silence indicates no managed web servers are visible in inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify web server scope", "reads": [ "device_hostname", "package_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%iis%' OR LOWER(package_name) LIKE '%apache%' OR LOWER(package_name) LIKE '%nginx%' OR LOWER(package_name) LIKE '%nacos%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A list of hostnames acting as web servers. Silence indicates no managed web servers are visible in inventory.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "staged-script-drops", "type": "query", "label": "Staged script drops", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE instr(',' || '{{staged_scripts}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Detect the creation of the reported staging batch scripts on scoped hosts.", "expected_signal": "File creation events for scripts like back.bat or user.bat. Silence for these exact names over 14 days is evidence of absence." }, "parents": [ { "id": "scope-web-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "Staged script drops", "reads": [ "device_hostname", "file_name", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE instr(',' || '{{staged_scripts}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "evidence_of_absence", "expected": "File creation events for scripts like back.bat or user.bat. Silence for these exact names over 14 days is evidence of absence.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-elevation-commands", "type": "query", "label": "Rare elevation tool execution", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%prcc1.rar%' OR LOWER(process_cmd_line) LIKE '%efspotato%' OR LOWER(process_cmd_line) LIKE '%cve-2022-0995%' OR LOWER(process_cmd_line) LIKE '%cve-2021-3156%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY cmd HAVING hosts < 3", "surface": "hb_process_activity", "description": "Identify rare process execution involving reported privilege escalation tools such as EfsPotato or Linux exploit strings.", "expected_signal": "Execution of known elevation tools seen on fewer than three hosts. A hit confirms an active exploitation attempt." }, "parents": [ { "id": "scope-web-servers" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare elevation tool execution", "reads": [ "device_hostname", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%prcc1.rar%' OR LOWER(process_cmd_line) LIKE '%efspotato%' OR LOWER(process_cmd_line) LIKE '%cve-2022-0995%' OR LOWER(process_cmd_line) LIKE '%cve-2021-3156%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY cmd HAVING hosts < 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Execution of known elevation tools seen on fewer than three hosts. A hit confirms an active exploitation attempt.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "cmd" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "early-stage-agent", "type": "analytic", "label": "Evaluate early intrusion signs", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "staged-script-drops", "rare-elevation-commands" ], "objective": "Determine if any host shows evidence of staging script drops or privilege escalation execution consistent with UAT-10147 tradecraft.", "description": "Assess whether the script drops and elevation commands indicate the start of a UAT-10147 intrusion.", "max_iterations": 4, "expected_signal": "Verdicts identifying specific hosts with a high probability of compromise.", "success_criteria": "A per-host verdict citing specific script names or elevation commands." }, "parents": [ { "id": "staged-script-drops", "kind": "merge" }, { "id": "rare-elevation-commands", "kind": "merge" } ] }, { "id": "evasion-registry-activity", "type": "query", "label": "Defender exclusion modifications", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%windows defender\\exclusions\\paths%' AND instr(',' || '{{exclusion_paths}}' || ',', ',' || LOWER(reg_value_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_registry_activity", "description": "Identify Registry modifications that add the malicious IIS directories to Windows Defender exclusions.", "expected_signal": "Registry writes that blind Defender for the exact paths where BadIIS modules are dropped. Single-host occurrences are critical findings." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Defender exclusion modifications", "reads": [ "device_hostname", "reg_target", "reg_value_name", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_name, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%windows defender\\exclusions\\paths%' AND instr(',' || '{{exclusion_paths}}' || ',', ',' || LOWER(reg_value_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Registry writes that blind Defender for the exact paths where BadIIS modules are dropped. Single-host occurrences are critical findings.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "persistence-scheduled-jobs", "type": "query", "label": "Persistence and discovery tasks", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'google chrome start' OR LOWER(job_cmd_line) LIKE '%appcmd%list%site%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_scheduled_job", "description": "Detect the reported 'Google Chrome Start' scheduled task and use of appcmd for reconnaissance.", "expected_signal": "Deceptive scheduled jobs or IIS configuration enumeration. Hits indicate established persistence." }, "parents": [ { "id": "early-stage-agent" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Persistence and discovery tasks", "reads": [ "device_hostname", "job_cmd_line", "job_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, time FROM hb_scheduled_job WHERE (LOWER(job_name) = 'google chrome start' OR LOWER(job_cmd_line) LIKE '%appcmd%list%site%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "Deceptive scheduled jobs or IIS configuration enumeration. Hits indicate established persistence.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "full-chain-agent", "type": "analytic", "label": "Full chain intrusion correlation", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "early-stage-agent", "evasion-registry-activity", "persistence-scheduled-jobs" ], "objective": "Identify hosts where the UAT-10147 chain is complete: early elevation combined with subsequent Defender blinding and deceptive scheduled jobs.", "description": "Correlate early staged script execution with follow-on evasion and persistence to confirm a complete UAT-10147 intrusion lifecycle.", "max_iterations": 6, "expected_signal": "Confirmed malicious verdicts for hosts showing the full lifecycle of the campaign.", "success_criteria": "A malicious verdict citing the linkage between early stage tools and follow-on persistence." }, "parents": [ { "id": "evasion-registry-activity", "kind": "merge" }, { "id": "persistence-scheduled-jobs", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the full-chain-agent verdict is malicious and identifies a link between privilege escalation and follow-on evasion", "condition": "the full-chain-agent verdict is malicious and identifies a link between privilege escalation and follow-on evasion", "blind_spot": "no-process-telemetry", "confidence": "high", "description": "Isolate the host if the agent confirms a high-confidence intrusion chain.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-chain-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain the compromised web server to prevent automated data theft.", "instructions": "Isolate the host immediately. Terminate active cmd.exe or powershell.exe shells and prepare for forensic evidence collection.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "forensic-validation", "type": "task", "label": "Forensic validation", "config": { "assignee": "analyst", "description": "Verify the identified artifacts and confirm the presence of rogue IIS modules.", "instructions": "1. Inspect C:\\Windows\\System32\\inetsrv and SysWOW64\\inetsrv for unexpected DLLs. 2. Verify the 'Google Chrome Start' scheduled task. 3. Check for new local users in the Administrators and Remote Desktop Users groups." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "hunt-closeout", "type": "task", "label": "Hunt closeout", "config": { "assignee": "analyst", "description": "Document findings and transition the behavioral signatures to standing detections.", "instructions": "Document the identified compromised hosts and promote the Defender exclusion registry query to a permanent detection rule for unauthorized exclusion paths." }, "parents": [ { "id": "forensic-validation" } ] } ] }